[Investigating][Severity: Critical][Web app exploit]

Ymirlink: unauthorized access to the Cuenote FC email delivery service

In the early hours of 16 October, Ymirlink, which runs the Cuenote FC email delivery service, found unauthorized access to some of its systems. Attackers exploited a program vulnerability to obtain the credentials of support and quality staff, then used a malicious program to export data from databases. Five systems on dedicated ASP plans were hit, and it estimates about 9 million records including email addresses were exported. NTTPC Communications, which uses the service, warned that its customers' email addresses may have leaked. On October 23 istyle, operator of @cosme, said traces of suspicious outside access were found in its environment and paused some newsletters, and Nomura Securities said email addresses and more of subscribers to its i-Port tool for financial institutions may have leaked. Dai Nippon Printing also said on 21 October that names, email addresses and internal IDs of users who opted in to newsletters from its honto bookstore may have leaked; the count is under investigation. In its second report on 26 October, Ymirlink said the damage had spread, partly through logins with stolen session data, and confirmed exports from 49 Cuenote FC systems totalling 51,628,280 records, with counts for 16 systems still being checked. In Cuenote BASE, its own customer management system, company names, names, phone numbers and email addresses of 190 contract holders could be viewed. It also warned of spam impersonating Saison sent from the cuenote.jp domain. The same day JR Central, JR West and JR Kyushu said email addresses and more of Express Reservation and smartEX members had leaked, about 170,000 records according to the Asahi Shimbun, and The Mainichi Newspapers and The Asahi Shimbun Company said their mailing data may have leaked. On 26 October Cybozu said email addresses and other data of recipients registered for some of its notice emails had likely leaked. On 27 October Resona Bank, Saitama Resona Bank and Kansai Mirai Bank said mail delivery customer numbers and email addresses had likely been taken, and on 26 October ValueCommerce said its mailing address book had been exported on the 16th.

Disclosed

2026-10-19

Organizations involved

Leaked or at risk

51.6M

51,628,280

Downtime

Unknown

Timeline

Detected 2026-10-16
Disclosed 2026-10-19
3 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: Web app

Data exposed or at risk

[Name][E-mail address]

Services hit

Service	Role	Impact level
Cuenote FC	[Breached]	[Critical]
Express Reservation	[Through a supplier]	[Critical]
smartEX	[Through a supplier]	[Critical]
honto	[Through a supplier]	[Major]
i-Port	[Through a supplier]	[Major]

Organizations involved

[Through a supplier][Critical]Aichi, Nagoya, NakamuraTransport and postal services170,000 leaked
Central Japan Railway Company
Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count. About 170,000 records according to the Asahi Shimbun.
[Through a supplier][Critical]Fukuoka, Fukuoka, HakataTransport and postal services
Kyushu Railway Company
Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count.
[Through a supplier][Critical]Osaka, Osaka, KitaTransport and postal services
West Japan Railway Company
Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count.
[Breached][Critical]Tokyo, ShibuyaInformation and communications51,628,280 leaked
Ymirlink, Inc.
[Through a supplier][Major]Tokyo, ShinjukuManufacturing
Dai Nippon Printing Co., Ltd.
Names, email addresses and internal IDs of honto users who opted in to newsletters; count under investigation.
[Through a supplier][Major]Tokyo, ChuoReal estate and rental
Nomura Securities Co., Ltd.
Email addresses and more of subscribers to its i-Port tool for financial institutions; count under investigation.
[Through a supplier][Major]Tokyo, MinatoInformation and communications
istyle Inc.
Traces of suspicious outside access in the environment for some @cosme mail; no count published.
[Through a supplier][Major]Tokyo, MinatoInformation and communications
NTTPC Communications, Inc.
Used it for service emails; customers' contact email addresses and other data may have leaked.
[Through a supplier][Major]Osaka, Osaka, KitaInformation and communications
The Asahi Shimbun Company
According to the Asahi Shimbun, Ymirlink reported that data was also exported from its environment; it changed the passwords of its admin accounts.
[Through a supplier][Major]Tokyo, ChuoInformation and communications
Cybozu, Inc.
Used it for some notice emails; email addresses and other data of registered recipients have likely leaked.

						Note
Central Japan Railway Company	[Through a supplier]	[Critical]	Aichi, Nagoya, Nakamura	Transport and postal services	170,000	Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count. About 170,000 records according to the Asahi Shimbun.
Kyushu Railway Company	[Through a supplier]	[Critical]	Fukuoka, Fukuoka, Hakata	Transport and postal services	Unknown	Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count.
West Japan Railway Company	[Through a supplier]	[Critical]	Osaka, Osaka, Kita	Transport and postal services	Unknown	Email addresses, member IDs, names in katakana and member types leaked for Express Reservation and smartEX members who were sent mail such as promotions and notices of timetable changes after the Kumamoto earthquake. The three companies announced it jointly; Ymirlink is still confirming the count.
Ymirlink, Inc.	[Breached]	[Critical]	Tokyo, Shibuya	Information and communications	51,628,280
Dai Nippon Printing Co., Ltd.	[Through a supplier]	[Major]	Tokyo, Shinjuku	Manufacturing	Unknown	Names, email addresses and internal IDs of honto users who opted in to newsletters; count under investigation.
Nomura Securities Co., Ltd.	[Through a supplier]	[Major]	Tokyo, Chuo	Real estate and rental	Unknown	Email addresses and more of subscribers to its i-Port tool for financial institutions; count under investigation.
istyle Inc.	[Through a supplier]	[Major]	Tokyo, Minato	Information and communications	Unknown	Traces of suspicious outside access in the environment for some @cosme mail; no count published.
NTTPC Communications, Inc.	[Through a supplier]	[Major]	Tokyo, Minato	Information and communications	Unknown	Used it for service emails; customers' contact email addresses and other data may have leaked.
The Asahi Shimbun Company	[Through a supplier]	[Major]	Osaka, Osaka, Kita	Information and communications	Unknown	According to the Asahi Shimbun, Ymirlink reported that data was also exported from its environment; it changed the passwords of its admin accounts.
Cybozu, Inc.	[Through a supplier]	[Major]	Tokyo, Chuo	Information and communications	Unknown	Used it for some notice emails; email addresses and other data of registered recipients have likely leaked.

Open in organization search

Sources

[1][Official]当社システムへの不正なアクセスに関するご報告（第一報）Ymirlink · 2026-10-19
[2][Official]ユミルリンク株式会社で発生した不正アクセスに伴うメールアドレス等の漏えいの可能性についてNTTPC Communications · 2026-10-20
[3][Official]【お知らせ】メール配信システム「Cuenote FC」への不正アクセスについてistyle · 2026-10-23
[4][Official]金融機関等向けポートフォリオ管理ツール「i-Port」に関するメール配信業務の外部委託先における情報漏えいの可能性についてNomura Securities · 2026-10-23
[5][News]野村証券、法人向けサービスで情報漏洩か　「委託先に不正アクセス」Nikkei · 2026-10-23
[6][Official]外部委託先への不正アクセスによる「honto」のお客様情報漏えいの可能性についてDai Nippon Printing · 2026-10-21
[7][Official]当社システムへの不正なアクセスに関するご報告（第二報）Ymirlink · 2026-10-26
[8][Official]ユミルリンク株式会社で発生した不正アクセスに伴うメールアドレス等の漏えいについてCentral Japan Railway Company · 2026-10-26
[9][Official]外部メール配信サービス運営会社への不正アクセスに伴うメールアドレス等の漏えいの可能性についてThe Mainichi Newspapers · 2026-10-26
[10][News]メール配信の「ユミルリンク」、アドレスなど5162万件流出かThe Asahi Shimbun · 2026-10-26